PrivateBin shares text and files with true zero-knowledge encryption: the server stores only ciphertext it cannot decrypt because the key exists exclusively in the URL fragment that never reaches the server. With over 8,400 GitHub stars and 500,000+ Docker pulls, it has become the standard for privacy-respecting paste sharing where not even the hosting operator can read stored content. All encryption uses 256-bit AES in Galois Counter mode performed entirely client-side in the browser. Burn-after-reading mode destroys pastes on first view, while configurable expiration timers automatically purge content after periods ranging from five minutes to forever. Optional password protection adds a second encryption layer requiring recipients to enter a passphrase before decryption occurs. Discussion threads enable anonymous or nickname-based commenting on pastes with IP-based identicon avatars for visual identity. Markdown rendering with live preview formats pastes as styled HTML, and syntax highlighting through prettify.js supports dozens of programming languages across four color themes. File upload support enables sharing images, PDFs, and media files with in-browser preview. QR code generation converts paste URLs for mobile device transfer. Customizable templates include Bootstrap 5, classic Bootstrap CSS, and Darkstrap themes. Storage backends support filesystem, MySQL, PostgreSQL, SQLite, Amazon S3, and Google Cloud Storage. Deploy via Docker with the privatebin/nginx-fpm-alpine image on port 8080. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. zlib licensed.

Two decades of continuous development made Roundcube the standard-bearer of open-source webmail - a PHP IMAP client that gives any mail server a polished, application-like interface in the browser. It connects to whatever IMAP/SMTP stack you run - Dovecot, Postfix, a hosted mailbox - and delivers the full desktop-client experience: drag-and-drop message management, threaded conversation views, full MIME and HTML mail handling, find-as-you-type address book with groups and LDAP connectors, multiple sender identities, full-text search, and spell checking in dozens of languages. The default Elastic skin is genuinely responsive, working as well on a phone as a desktop, and the entire UI is skinnable. The plugin API is where deployments get shaped: managesieve exposes server-side filter management in the UI, enigma brings PGP encryption and signing via GnuPG, markasjunk trains spam filters, zipdownload batches attachments, password lets users change credentials, and attachment_reminder catches the classic forgotten-attachment email - among hundreds of community plugins. Built-in caching keeps large mailboxes fast, IMAP ACLs and shared folders support team setups, and XSS protection is engineered into the rendering pipeline. It scales from a single personal mailbox to unlimited users, backed by MySQL, MariaDB, PostgreSQL, or SQLite. GPL-licensed with regular security releases.

Personal, minimalist, database-free bookmarking - Shaarli is a philosophy as much as an app. Everything lives in a single compressed datastore file inside data/: no MySQL, no PostgreSQL, backup by copying one directory. That write-once/read-many file is usually served straight from OS disk caches, which is why a decade-old Shaarli instance with tens of thousands of links still responds instantly. Designed deliberately single-user, it saves URL, title, unlimited-length description, and tags (with autocomplete, renaming, and merging), marks entries public or private, and automatically strips utm_source and fb tracking parameters from saved URLs. That description field is why the community uses Shaarli as far more than bookmarks: a microblog, read-it-later queue, code-snippet base, pastebin, and shared clipboard between machines. Sharing is one click via bookmarklet or Android apps; consumption is per-tag RSS/Atom feeds plus a daily digest feed; search is full-text with tag filtering. A REST API opens it to any client, a plugin and theme system extends the PHP core (Markdown rendering, thumbnails), and import/export uses browser-standard Netscape HTML - your data enters and leaves freely. LDAP login is supported, no telemetry is sent anywhere, and the UI degrades gracefully without JavaScript. The anti-cloud Delicious.

Perplexity's search experience without Perplexity: Vane deploys Perplexica, an open-source AI answer engine built as the self-hosted alternative. Instead of returning a page of links, it reads your question, searches the live web through the SearxNG metasearch engine, and composes a direct answer with cited sources. Retrieval quality comes from embeddings and similarity search: fetched pages are re-ranked against the query so the model answers from the most relevant passages rather than whatever ranked first. Two query modes cover different needs - Normal mode runs a straightforward web search, while Copilot mode generates multiple reformulated queries and actively pulls content from top matches for harder questions. Focus modes specialize retrieval for academic papers, YouTube, Reddit discussions, Wolfram Alpha calculations, or the general web. The answering model is your choice: OpenAI-compatible APIs or fully local LLMs such as Llama 3 and Mixtral through Ollama, which keeps queries entirely on your infrastructure. Because SearxNG pulls live results, answers reflect current information, and no search history is tracked.

Real-time alerts from your own infrastructure to your phone, with no Firebase, Pushover, or third-party push service in the path: Gotify is a simple, self-hosted notification server written in Go. The model is deliberately minimal: senders push messages with a single HTTP POST to the REST API, receivers subscribe over a WebSocket stream, and a clean React web UI manages the pieces. Senders are namespaced as "applications," each with its own token, so your backup script, Uptime Kuma, CI pipeline, and cron jobs each get an identity, an icon, and independently revocable credentials - centralized alerting from many services with per-source management. Messages carry a title, body, and priority level that maps to notification importance on the client. The official Android app (on both F-Droid and Google Play, notable for working entirely without Google Play Services) shows push notifications for new messages; the web UI itself supports Web Push in the browser; and gotify/cli pushes messages from shell scripts with one command. A server-side plugin system adds custom behavior, and the whole thing runs as a single small binary with SQLite by default - near-zero resource footprint. Because dozens of tools (and Apprise) speak Gotify natively, it slots in as the notification hub for an entire homelab or ops stack.

Roughly $1M of development work, open-sourced: Maybe Finance began as a $249/year commercial personal finance product before the company released it all. It aggregates bank accounts, credit cards, loans, investments, crypto, and real estate into a single net worth dashboard with historical trend charts - replacing the spreadsheet that usually glues a whole portfolio together. Transactions are categorized and tagged with rules, with merchant tracking and search across imported or synced activity; budgets track spending by category against plan; and the investment view follows holdings, cost basis, and returns across brokerage accounts. Multi-currency support converts accounts held in different currencies into a single reporting currency, bank synchronization works through Plaid where supported, and manual CSV import covers any institution. An optional AI assistant answers questions grounded in your own financial data. Because the app was built as a paid product with professional design before being open-sourced, its interface quality exceeds most community finance tools - and self-hosting means your balances and transactions are not monetized by a free app or gated behind an annual subscription. The stack is Ruby on Rails with Hotwire on PostgreSQL, licensed AGPL-3.0 and deployed via Docker. The original repository is archived; development continues in the community fork Sure, compatible with the same self-hosted setup.

Perplexity's answer-engine experience, self-hostable and open-source: Morphic searches the web and writes cited answers. Instead of returning a list of links, it searches the web, reads the sources, and generates a complete answer with inline numbered citations. The generative UI streams rich components, source cards with thumbnails, image grids, syntax-highlighted code, and LaTeX math, rather than plain markdown. Quick mode answers fast; Adaptive mode runs deeper multi-step research. Search backends are pluggable: the Docker Compose bundle ships with a private SearXNG instance so no search API key is required, and Tavily, Brave, and Exa are supported alternatives. LLM providers include OpenAI, Anthropic, Google, Ollama, and any OpenAI-compatible endpoint, with per-mode model mapping - fast, cheap models for quick searches, stronger models for adaptive research, tuning the cost-quality trade-off per query type. An inspector panel exposes tool execution during multi-step research, and AI-suggested follow-up questions keep an investigation moving. Chat history persists in PostgreSQL, results are shareable by URL, file uploads feed context into queries, and optional Supabase authentication adds multi-user or guest access. Because the default search path is your private SearXNG instance, research topics never hit a commercial search API - and with local Ollama models the marginal cost of a query approaches zero. Built with Next.js, TypeScript, and the Vercel AI SDK under Apache 2.0.

Mail-in-a-Box turns a single Ubuntu server into a fully functional email system with one setup command, installing and configuring Postfix for SMTP, Dovecot for IMAP, Roundcube for webmail, and Z-Push for Exchange ActiveSync push notifications in an automated sequence that would take days to replicate manually. The DNS server auto-configures the full suite of email authentication records: SPF, DKIM, DMARC, DNSSEC with DANE TLSA, MTA-STS, and SSHFP. Getting all of these right is what separates email that lands in inboxes from email that lands in spam, and most manual installations never achieve the complete set. Nextcloud integration adds CardDAV contact sync and CalDAV calendar sharing across devices. Let's Encrypt certificates provision and renew automatically for every hosted domain. The web control panel manages users, aliases, custom DNS records, and automated backups, protected by TOTP two-factor authentication. Daily health checks verify that services run correctly, ports remain open, TLS certificates stay valid, and DNS records resolve properly, alerting you before delivery problems develop. Multiple domains and users operate from one installation with internationalized domain name support. Built-in HTTPS static site hosting uses the TLS infrastructure already in place. Runs on a dedicated RepoCloud VPS with guaranteed resources, root SSH, and browser serial console for complete email sovereignty. CC0 public domain licensed.

SnappyMail is a fast, privacy-respecting webmail client that connects to any existing IMAP and SMTP server, booting in under a second with a JavaScript payload of just 138 KB under Brotli compression (down from RainLoop's 8 MB fork origin). No database is required: all configuration and user data persists as flat files in a single volume, making Docker deployment trivially simple with the roughly 30 MB image consuming approximately 50 MB of RAM. Built-in PGP encryption supports three backends: OpenPGP.js v5 with ECDSA and EDDSA key generation, GnuPG integration, and Mailvelope browser extension compatibility, eliminating the need for separate encryption plugins. The integrated Sieve script editor enables users to create mail filtering rules, vacation auto-responders, and forwarding conditions directly within the web interface when connected to ManageSieve-capable servers on port 4190. Multi-domain administration allows a single instance to serve users across multiple IMAP servers with per-domain authentication routing. The admin panel manages extensions, security settings, branding customization, and domain configuration. GDPR-friendly by design, it removes all social media integrations, Gravatar lookups, and external tracking present in RainLoop. Dark mode strips background and font colors from email messages. The modified Squire HTML editor replaces CKEditor for composing rich-text messages. Scores 99% on Lighthouse performance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

The Bitwarden server, reimplemented in Rust: Vaultwarden (formerly bitwarden_rs) is the unofficial lightweight edition. It speaks the same wire protocol as the official server, so every official Bitwarden client - browser extensions, iOS, Android, desktop, and the bw CLI - connects without modification, while the server itself runs as a single container against SQLite (or MySQL/MariaDB/PostgreSQL) instead of the official multi-container stack that wants gigabytes of RAM. Features Bitwarden gates behind paid tiers ship free: organizations with collections, groups, member roles, and policies; TOTP code storage; file attachments; Bitwarden Send; Emergency Access; event logs; and admin password reset. Two-factor options cover authenticator apps, email, FIDO2 WebAuthn, YubiKey, and Duo, and OIDC-based SSO landed natively in v1.35.0. Zero-knowledge encryption is unchanged - vault data is encrypted client-side and the master password never reaches the server. Attachments and Sends store on local disk or S3-compatible backends, an admin panel manages users and server settings, and backup is copying one data directory. Suited to individuals and teams up to roughly 50 users.

With over 38,000 GitHub stars, nearly one million registered users, and over 1.3 million resumes created, Reactive Resume delivers a professional resume creation experience that rivals commercial platforms like Resume.io and Zety without collecting user data, showing advertisements, or imposing paywall restrictions. The real-time WYSIWYG editor renders changes instantly as users type, providing immediate visual feedback across all resume sections including work experience, education, skills, certifications, projects, and custom sections with typed extensions. Over fifteen professionally designed templates with full color customization, font selection, spacing adjustment, and icon style selectors ensure each resume reflects individual style preferences. The drag-and-drop system lets users move items between sections and pages freely across multi-column and full-width layouts. PDF generation produces pixel-perfect documents using a headless Chromium rendering pipeline, ensuring consistent output across all devices and print settings. Multi-language support covers over twenty languages with RTL script handling for Arabic and Hebrew. Authentication supports passkeys and multiple OAuth providers via Better Auth, while self-hosted deployment runs via Docker Compose with PostgreSQL and Browserless for PDF rendering. The import system accepts JSON Resume format, LinkedIn data exports, and PDF/DOCX files when AI integration is configured. AI-powered content suggestions using OpenAI, Google Gemini, Anthropic Claude, or local Ollama models help improve bullet points and professional summaries. A CSS editor with autocompletion allows fine-grained styling control. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 10,800 GitHub stars earned in under two years, Blinko has emerged as the privacy-first answer to cloud-dependent note-taking tools by combining instant thought capture with AI-powered retrieval that actually understands what you wrote rather than just matching keywords. The core engine uses Retrieval-Augmented Generation to build vector embeddings of every note in your PostgreSQL database, enabling natural language queries like "what were my thoughts on the database migration last Tuesday" to surface relevant content through semantic understanding rather than exact string matching. AI integration supports both cloud providers — OpenAI, MiniMax, and compatible endpoints — and fully local inference through Ollama running models like Llama 3.2 on your own hardware, ensuring your notes never leave your network when privacy demands it. Built on Next.js with a React frontend, the web interface presents notes as cards with full Markdown support including code blocks, LaTeX, and rich formatting, with a clean input bar for capturing fleeting thoughts in seconds. The Tauri-based desktop and mobile clients extend access to macOS, Windows, Linux, and Android with native performance characteristics. Notes are stored as plain text in PostgreSQL with vector indexes that update incrementally as new content arrives, and the embedding index can be rebuilt on demand when switching between AI providers. Multiple users can share a single instance with individual accounts, and data exports to standard formats. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

With over 21,000 GitHub stars and six years of steady development through version 3.1.0, Neko transforms any Docker container into a fully interactive browser or desktop environment streamed to web browsers via WebRTC with sub-300-millisecond glass-to-glass latency. The Go backend captures X server display frames using the Pion WebRTC library while the Vue.js frontend renders the remote session with native audio synchronization, delivering a significantly smoother experience than Apache Guacamole or noVNC which rely on image-over-WebSocket approaches. Multiple users simultaneously view and collaboratively control the same session with real-time input synchronization and host-managed control passing between participants. Pre-built Docker images cover Firefox, Chromium, Google Chrome, Tor Browser, Brave, Vivaldi, and Microsoft Edge alongside full desktop environments including XFCE and KDE for running any Linux application. Neko Rooms provides multi-tenant deployment with a REST API for programmatic room provisioning, while Neko Apps extends the platform with additional containerized applications beyond browsers. Sessions persist on the server independently of client connections — close your laptop, reconnect from your phone, and resume exactly where you left off. Optional VPN and Tor integration routes traffic through encrypted tunnels for privacy-sensitive browsing. RTMP broadcasting streams sessions to external platforms. The embeddable client supports iframe integration for custom portals and applications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

The CAPTCHA bargain - annoy your users and feed their behavior to Google - gets replaced with economics by mCaptcha. Instead of image puzzles, it uses SHA256 proof-of-work: every visitor's browser silently solves a small computational challenge (via a WebAssembly library) before submitting a form. Humans never notice the milliseconds; bots hammering your site must burn more compute sending requests than your server spends answering them, which makes attacks more expensive than defense - the property that also makes mCaptcha genuine DoS protection, not just bot filtering. Written in Rust, the system is fully automated: difficulty scales with traffic, so challenges stay trivial in normal conditions and harden under attack. The privacy and accessibility wins are structural rather than promised: no tracking, no profiling, no user-pattern data collection, and no visual puzzles that exclude users with visual or cognitive impairments - the design was published in Communications of the ACM. Rate limiting is IP-independent, so users behind NATs, VPNs, or Tor get the same experience instead of endless challenge loops, and proofs resist replay attacks, neutering captcha farms. Migration is deliberately easy: the API is compatible with reCAPTCHA and hCaptcha, making it a drop-in replacement. AGPL-licensed core with proprietary-friendly client libraries.

With over 48,000 GitHub stars and monthly releases since March 2023, LocalAI is the self-hosted AI engine that replaces every OpenAI endpoint with a single Docker container running on your own infrastructure — serving chat completions, image generation, text-to-speech, speech-to-text, embeddings, vision, video generation, and function calling through identical API schemas that require zero application code changes. The composable backend architecture isolates each inference engine as a separate gRPC service running in its own OCI container, so llama.cpp, vLLM, SGLang, transformers, whisper.cpp, diffusers, MLX, Stable Diffusion, and Flux install on demand without touching the core, can run on separate machines, and a fault in one never affects others. Hardware acceleration spans NVIDIA CUDA 12 and 13, AMD ROCm, Intel oneAPI/SYCL, Apple Silicon Metal, Vulkan, and NVIDIA Jetson L4T — or runs entirely on CPU without any GPU. Built-in AI agents support autonomous tool use, retrieval-augmented generation, Model Context Protocol integration, and skill-based workflows directly in the web interface. The model gallery provides curated YAML configuration files for hundreds of models that install with a single command, while P2P federated inference distributes model shards across multiple machines for running models larger than any single node's memory. Multi-user API key authentication with quotas and role-based access enables team deployments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Over 400 technologies and thousands of smart devices from any manufacturer, unified under one roof: openHAB is the vendor-neutral home automation platform with a pluggable binding architecture. Each binding translates a device or service into openHAB's clean abstraction: Things expose Channels, Channels link to Items, and Items feed a rules engine that runs your home. That engine meets you at your skill level: Blockly gives non-programmers drag-and-drop visual logic, JS Scripting (GraalJS with the openhab-js library) is the modern text-based standard, the classic Rules DSL remains supported, and JSR223 opens the door to Python, Ruby, and Groovy. Time- and event-based triggers, scripts, notifications, and voice control compose into automations of any complexity, and users report decade-old rule sets still running rock solid. The Main UI handles configuration, semantic modeling, and now built-in charting - no external Grafana required. Built in Java on Apache Karaf's OSGi runtime and stewarded by the non-profit openHAB Foundation, it requires no cloud to function: everything runs locally, talking directly to your devices. Optional connectors bridge to Alexa, Google Assistant, and HomeKit, with iOS, Android, and web apps for control from anywhere.

Every unit of income gets a job in Actual Budget - a local-first personal finance app built on envelope (zero-sum) budgeting, where you can only budget cash you actually have, which keeps the plan honest by construction. The data model is a SQLite file that lives on your device and works fully offline; the self-hosted Node.js sync server adds background multi-device synchronization using CRDT-based distributed-systems machinery, browser and mobile access as an installable web app, and automated backups. Optional end-to-end encryption makes the synced data unreadable even to the server hosting it. Transactions enter three ways: manual entry, file import (CSV, QIF, OFX, QFX, CAMT.053), or automatic bank syncing through GoCardless for EU/UK banks and SimpleFIN for US/Canada. Built-in YNAB4 and nYNAB importers migrate complete budget histories, and reports, schedules for recurring transactions, and rule-based transaction cleanup handle the day-to-day. A fully featured local API lets developers script custom importers and automation against their own data. 100% free, open source, and 26k stars strong.

One statically-compiled Go binary over PostgreSQL, no ORM, no framework, static assets embedded in the executable: Miniflux is the minimalist, opinionated feed reader. The opinions are the feature: page layout, fonts, and colors are tuned for reading, and everything else is treated as noise. It consumes Atom, RSS, and JSON Feed formats with OPML import/export, organizes articles with categories and bookmarks, fetches original full-text content for summary-only feeds, and provides Postgres-powered full-text search. Privacy work happens automatically: pixel trackers are stripped, tracking parameters removed from URLs, a media proxy blocks third-party tracking, referrers are never forwarded, and there is zero telemetry. Navigation is keyboard-first - j/k through items, o to open, f to star - with touch gestures on mobile. Podcast, video, and music enclosures are supported, and YouTube videos play inline. Over 25 integrations save articles onward to Wallabag, Readwise Reader, Pinboard, Linkding, Instapaper, Notion, Telegram, Matrix, Ntfy, and more, plus webhooks and a REST API with Go and Python clients; the Google Reader API endpoint supports existing mobile reader apps. Authentication spans local passwords, passkeys (WebAuthn), Google OAuth2, OpenID Connect, and reverse-proxy headers. It is Apache 2.0 licensed, translated into 20 languages, and updates feeds on an internal scheduler.